diff --git a/terraform2.0/modules/gateway/main.tf b/terraform2.0/modules/gateway/main.tf
index 51aae80..1a2cf7b 100644
--- a/terraform2.0/modules/gateway/main.tf
+++ b/terraform2.0/modules/gateway/main.tf
@@ -4,10 +4,11 @@ resource "aws_instance" "defguard_gateway" {
   key_name      = var.key_name
 
   user_data = templatefile("${path.module}/setup.sh", {
-    grpc_port       = var.grpc_port
-    nat             = var.nat
-    package_version = var.package_version
-    log_level       = var.log_level
+    grpc_port                    = var.grpc_port
+    nat                          = var.nat
+    package_version              = var.package_version
+    log_level                    = var.log_level
+    core_disconnect_grace_period = var.core_disconnect_grace_period
   })
   user_data_replace_on_change = true
 
diff --git a/terraform2.0/modules/gateway/setup.sh b/terraform2.0/modules/gateway/setup.sh
index 9b28de0..829b6ab 100644
--- a/terraform2.0/modules/gateway/setup.sh
+++ b/terraform2.0/modules/gateway/setup.sh
@@ -53,6 +53,9 @@ userspace = false
 cert_dir = "/etc/defguard/certs"
 # Enable automatic masquerading of traffic by the firewall
 masquerade = ${nat}
+# Seconds to wait after losing the Core connection before tearing down the WireGuard
+# interface and purging the adoption certificates
+core_disconnect_grace_period = ${core_disconnect_grace_period}
 log_level = "${log_level}"
 
 # Optional: HTTP port exposing gateway health status (200 connected, 503 not connected)
@@ -75,8 +78,12 @@ systemctl daemon-reload
 log "Enabling defguard-gateway service..."
 systemctl enable defguard-gateway
 
-log "Starting defguard-gateway service..."
-systemctl start defguard-gateway
+# The package postinst already started the service, using the gateway.toml shipped with
+# the .deb -- long before this script wrote the configuration above. `systemctl start` on
+# an already-active unit is a no-op, so the service would keep running with the packaged
+# defaults (notably `masquerade = false`) for the life of the instance. Restart instead.
+log "Restarting defguard-gateway service to apply the configuration written above..."
+systemctl restart defguard-gateway
 
 log "Setup completed."
 ) 2>&1 | tee -a "$LOG_FILE"
diff --git a/terraform2.0/modules/gateway/variables.tf b/terraform2.0/modules/gateway/variables.tf
index 3333ff8..5855bea 100644
--- a/terraform2.0/modules/gateway/variables.tf
+++ b/terraform2.0/modules/gateway/variables.tf
@@ -43,3 +43,9 @@ variable "log_level" {
   type        = string
   default     = "info"
 }
+
+variable "core_disconnect_grace_period" {
+  description = "Seconds the Gateway waits after losing the Core connection before tearing down the WireGuard interface and purging its adoption certificates. The binary defaults to 30, which is short enough that an ordinary Core restart triggers it."
+  type        = number
+  default     = 300
+}